8dc4fab77b3e8b8d5a289199dfcf0d1f4cb2514d3d00fa81dd57b47275f02f8b

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0ff4aa19427569a916b6d95bbc5e23c.html
Size

83KB
MD5

e0ff4aa19427569a916b6d95bbc5e23c
SHA1

c9d88ef5fb8804818fdd0cd73282897302e081a2
SHA256

8dc4fab77b3e8b8d5a289199dfcf0d1f4cb2514d3d00fa81dd57b47275f02f8b
SHA512

b3c13bf536495dae269aa04cfef2fd8d57a1222d84d22644f8a02dd2e902bc2aa856e3e3f60038836b93d4b8753deb860d1e1e21a15b6fc8361de891958246b8
SSDEEP

1536:IlriuaSr0Q70NcNtxNSNeNBNYNoNJNbNGbxQ:Il+uaSrZ0NcNtxNSNeNBNYNoNJNbNG2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000dfeb2ab984dd235e15819e3c73ea2a3b650333a0d7fb3c0a80868916812450d8000000000e8000000002000020000000f58aec3375f506dd6bf7ca813fd6f8bb286f4a007d9267f612addccbe6600a85200000000e3761fb675d972f244ef7410caab4ee6cd72a931daa07ef965fd9ae1a9240ca40000000a7b510b3515ca3e85155b5a996d693855ef6bf63485efeecb340b44df5b1cd487c769f4dd286121197f6a7d1e4a9faab021f7cd762cf2e123993401061029f5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE327B81-EC03-11EE-9988-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b31fa91080da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417683045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000afa63f499075f120922259a04e85ab273854e8e0ad00ccb10745ea98b5e16b1f000000000e80000000020000200000007bf4e1842fee0d837041ff3bddae671fce1eaa6a80f84581625973d2e432682690000000d12b172e37ca83576bbfa27bc7127285a4c3c55891e6f1b6332291ac0380e576c207a588a23a478855b9b5e0d6e1f82a103cd0bd501aa2a604b42768d7f99c98f81fca8bd0c1c4c489b63e545857a9f90bcb30fc710ae08dd29f117e29df5117a5a81b6298717286a6626005d5e7de80291028b83ee725b787c0af325716acc74840542973e31c3473af52e74ae56a3e400000005da08787212409b14f9b4a24967cae9ec14366f16c512cd4ba0cab38fd8e4ca8498465058d7d581af3aec41320b4936e6e011e3778d0ddda9ccc6d4989aae9ff	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2540	1888	iexplore.exe	28
PID 1888 wrote to memory of 2540	1888	iexplore.exe	28
PID 1888 wrote to memory of 2540	1888	iexplore.exe	28
PID 1888 wrote to memory of 2540	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0ff4aa19427569a916b6d95bbc5e23c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
d7ec934c4ca7d9c69239fcf158360baf

SHA1
f45bf051c53f64028353d91f9a10a4021880fd75

SHA256
b3dcfc7fc2c21314a2104b1472781647d80733adde36455bc305f581b735c4a8

SHA512
10eb9fece073467170a1db537d9c1f2147222c27df2d5f3a26833eac8b406b99757a2e25c08207160f485edfbe55ed4e9a1b012d970f02373c89c419e8138044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
42f3574c6bdbaa22318935fbf9c35441

SHA1
8d2af8ba739e2a7080cb33d8782ec77c8193d66b

SHA256
7aa1c0653c4202952f2df11e779c4c3498ec8f26f9edf23a3e13666a91ce9c7b

SHA512
8bd4552ca9e229b0ed94d89ab7b93f970ce5a5fd0033741fd0d3161cd5b52cb38c5c0b18761f4485744d49faad5cdecaba3d1a089f58936c366eba02f132358d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df7ddf04eb79f9c6f5eff1437556b83a

SHA1
f74fdf313c90a37246946cb819141939c0463845

SHA256
28ecb87c237f9194bd10c3d868176f39f302f5db9d74ee677ae8b450e1453954

SHA512
ef7547fcf3d56060ccba30f81a97e66ed4a2190cff1107cae2b90e7990ddaeeebda5e35be89593d02ad0ad47ea097871578090f798d7be9060137d213b559887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0fcd1557e81162bdae7086e218e0a1c

SHA1
2801273cbdb8acb60863c4b0d79682ac3f1f2361

SHA256
bb6a4bfaef59e0e1d88bd912a8e0c3b048864e4b956ac872cc8aaa7c9b1f9c5a

SHA512
89203f62c00a8c289f856b43823d11265e6e8ecc6b7839ab43dcc2be64e5224fdfafea66d7bfef1bc431b000d80d2468df3e675805402bfb36d0a974b751d2ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49c791c483a031df3e26e2ccd6a966b7

SHA1
b2202cb446faee0355669cb5e43d0a8343cd90c0

SHA256
27cf22bcc5f3e0e046fd02b438264fb645ddc2b2bcdf2852ca8ba95b75dc3769

SHA512
541d015e23b789b9a4a6518b0a984d6ff922f2a0457b0f4844a9109dea758767dcabee095635d5cac9b113e3e5960b8cb468c6733c3e57bbddfd6cee7a9f7bd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdb4818aa1859c0ab8b6c00dd7b2023a

SHA1
5aa953d969077cc876b102a5d4efd689c49a353d

SHA256
fbb950ada99bc57d06f5c967e11b40a239b954422d430e00905248eeea13c397

SHA512
d0a75150ed961df974e85d24281de8cad12d7ce3eea4e4f2e1b5b9eda56e6a97488ba6ce11bfe33203453204f458f07315117d03f6fa7f56aeff74042c4f390a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
078a14d220e0144c06a29802fd213c24

SHA1
1b177b743085faf823c9eb208abf8beae09a1aaa

SHA256
841279ca3062e72ae75b22b6d78b4ea4acd26ffddc7cebc41524bf4d772f9f06

SHA512
31dbf89788e347feedd86bee62b569222f78f8c980ba5091e2fd10e6d10cbfb0faf67d398570c48a35fe7bb5fcea4d88e09a718b147d4917847c227180c82d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3f680f09cbca37bb90b716533e7e7be

SHA1
1241fc977dc0adc420a39419749679e5e75fdca7

SHA256
3836a438367e44cc80fa71c4851d72c068106293ade5b243d523642aa0494b6d

SHA512
1756036c6a107df24fc0855e966f4b80490aaa8b39c8f75a38154ca953808b07391630e4c8bdd0a11b0edee616de386c31c3e0c07ee22e7c43a19562810a9ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14740a766a4dca7e4d18bd3d8b3207e2

SHA1
10f1d9997e8c138fce3ac6762a47c6c3c50b43e0

SHA256
d24827b2ae6178956cdbd10507a70a1798e735ffd0b2107c2bfa65c931ee6e9b

SHA512
74279ea9b17915caeb2c87b84196f69cf9be1626fcd2341b8dc2c5cd34a1b2d3c4b9bc35e73c805d29c362b7ad1dac6bc7a09fed09188dc9c76580aaffd7c1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29c879ac455a690a161fe1cadeb4b5be

SHA1
e094e26a3f6987c6bf0bd397f1184833be4bbf47

SHA256
b3ffb5ce0d7206503dab4deae55510d180d3269ed48e58a894f15e77b0632598

SHA512
7aee9d58ed7bbbe0cff17f66d9b0f1f15791526a27babafd3486302d4e8e6d077b72b396dbe0a821479019eb6a5824037721b10157505d5df5b61ad7e2cd224a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50342951abb88932472e6c4ba4098ff

SHA1
5e8bcdb5f7664ad82824e40fab8643429dd7c41b

SHA256
3e19a2bd5e93d77c33a510d310f78258e9ec9e4abedef23dbaf5f99d2c2ffde4

SHA512
a8037f8d1d9fbde63a1ad8bef428fefdd575f7a335cb09bf73bd3eeb506e08cff64edd6131adb49b2d6028a820bef80c64ab1ad8aadd61e47a9866bdfa9c57df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0d67e6edae30fb93f437058880a3f6d

SHA1
d409b74f1741a25c7df4d1adc2cecd9344c924d7

SHA256
c9f166fc69b2b6aba9550121c4d7c456437949e0f142e427290e048e2252d23d

SHA512
3e1f985d2323ae1dfef3384ca7239aa3d02c69d0a08fa3e81f4db3c038ded158306710e015488bb2815a9e82b2141234060fb6f78cab7d05ca7f73453d95e24d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c6008ec60dd4079a19f674aee3a85942

SHA1
ee01d2f06b7ea1f847e743e9029237d69e3eabaf

SHA256
65dc9e1cb63e07d90ece2683e555686707b5e039e036ecb888c6fac4ec795c9f

SHA512
39f15778402c2a68694f4e4833f6cd8480962c6957f136201890b7963f494fd78665dd0a34479dee33d39da403bc5886f246a8ed5114ac1407a5e28f32c29966

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B97.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C65.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D93.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit